How to create and alert that pops up from search?

[bolopez]

I want to create an alert that pops up when the events match at least 500 times the same source IP address, same destination address and different destination ports in 1 minute.  The search I've come up with so far is as follows, although I'm not sure it's what I really need: 

index=net-fw (src_ip=172.16.0.0/12 OR src_ip=10.0.0.0/8 OR src_ip=192.168.0.0/16) AND (dest_ip=172.16.0.0/12 OR dest_ip=10.0.0.0/8 OR dest_ip=192.168.0.0/16) action IN (allowed blocked)
| stats first(_time) as date dc(dest_port) as num_dest_port by src_ip, dest_ip | where num_dest_port >500 | convert ctime(date) as fecha

I think what I am missing to achieve is "with the same source IP and the same destination IP in one minute".

Could someone help me with this problem? Thanks in advance and best regards.

[ITWhisperer]

Try something like this

index=net-fw (src_ip=172.16.0.0/12 OR src_ip=10.0.0.0/8 OR src_ip=192.168.0.0/16) AND (dest_ip=172.16.0.0/12 OR dest_ip=10.0.0.0/8 OR dest_ip=192.168.0.0/16) action IN (allowed blocked)
| bin span=1m _time as minute
| stats first(_time) as date dc(dest_port) as num_dest_port by minute, src_ip, dest_ip 
| where num_dest_port >500 
| convert ctime(date) as fecha

[bolopez]

Okay, thank you so much, I'll try that.